Cybersecurity, AI and the Autonomous OT Era

“Operational technology is one of those things most people never think about until it stops working.”

Power grids. Drinking water. Manufacturing lines. Traffic signals. Railways. Hospital HVAC systems. All rely on operational technology (OT), the systems that monitor or control physical equipment and processes. Increasingly, artificial intelligence is becoming part of those environments.

AI can improve predictive maintenance and anomaly detection, but it also changes the cybersecurity stakes.

“When you connect an AI system to something that can open a valve or reroute power, you're not just adding intelligence, you're adding a new class of attack surface and a new way for something to go wrong quickly, with real physical consequences,” said Rupesh Shirke.

Shirke, a current Ph.D. in Information Technology student at University of the Cumberlands, has spent 18 years working in cybersecurity and critical infrastructure. He currently serves as associate principal security and infrastructure architect supporting Chevron’s operational technology and industrial control systems (OT/ICS) environment.

Now, he is applying that professional experience, along with the research mindset he has developed through his doctoral studies at Cumberlands, to a growing challenge at the intersection of artificial intelligence, cybersecurity, and critical infrastructure.

It is also the subject of his book, The Autonomous OT Era: Securing AI-Driven Industrial Control Systems.

From Cybersecurity Practitioner to Researcher

Shirke did not set out to build a career in cybersecurity.

He started as a software engineer at Siemens, where he repeatedly encountered systems that worked as intended but raised another question: How would they hold up if someone deliberately tried to break them?

That question eventually led him into security administration and vulnerability management. From there, he followed what he calls the “harder, more interesting problems” through penetration testing, threat intelligence, architecture, enterprise governance, and executive advisory work.

More than a decade into that career, Shirke began considering a Ph.D. He wasn't looking simply for another credential. Professional experience had taught him how to solve the problem in front of him. He wanted the research skills to step back and ask larger questions about why those problems persisted and what the evidence actually supported.

“What I was hoping to gain was the discipline of real scholarship, how to ask a precise question, interrogate my own assumptions, and defend a claim with evidence rather than just years of experience,” Shirke said. “That's what the program has given me, and it shows up in how I approach everything I write and advise on now.”

At Cumberlands, that distinction between professional expertise and scholarly inquiry became particularly important.

“Practitioner experience teaches you what works,” he said. “Doctoral research trains you to ask why it works, what the evidence actually supports, and where your own assumptions might be wrong.”

Cumberlands' Ph.D. in Information Technology gives working technology professionals opportunities to develop advanced research skills while exploring areas such as cybersecurity, information governance, enterprise risk management, data science, predictive analytics, and emerging technologies. For Shirke, that education has become a way to examine the challenges he already encounters professionally with greater rigor.

One of those challenges is what happens as artificial intelligence moves beyond the digital world.

What Happens When AI Enters Operational Technology?

Operational technology controls or monitors physical processes. In critical infrastructure, that can mean systems involved in generating power, treating water, manufacturing products, or operating transportation networks.

AI is increasingly being introduced into those environments for purposes such as predictive maintenance, autonomous anomaly detection, and machine-driven decision-making.

The problem, Shirke says, is that many OT systems were never designed with that level of connectivity or autonomy in mind.

“What's changed recently is that AI is being layered into these environments faster than the underlying architecture was ever designed to accommodate,” he said.

That creates cybersecurity challenges that aren't always addressed by traditional IT security practices.

One misconception, according to Shirke, is that operational technology remains isolated, or “air-gapped,” from other networks. IT and OT have been converging for years, and AI can accelerate that convergence because intelligent systems depend on data moving in and decisions moving out.

Another is that AI should be viewed only as a cybersecurity advantage. AI can improve detection and response, but it can also give attackers new capabilities and introduce new types of failures, including an AI model confidently making the wrong decision.

Traditional IT security practices don't necessarily translate cleanly to OT environments either. Operational systems may depend on legacy protocols, strict safety certifications, or equipment that cannot simply be taken offline for routine updates.

The difference becomes particularly important when a cybersecurity failure can affect more than data.

“The gap between human oversight and machine autonomy keeps growing,” Shirke said, “and when that gap fails in an OT environment, the consequences aren't just digital, they're physical.”

How Can AI-Driven Critical Infrastructure Be Secured?

Shirke had watched that gap develop over nearly two decades in cybersecurity.

Organizations were introducing intelligent technologies into physical infrastructure, he said, while often continuing to protect those environments with security approaches developed for traditional IT systems.

The widening disconnect became the foundation for The Autonomous OT Era.

Shirke describes the book as a field manual rather than a theoretical examination of AI. It explores issues including machine-learning manipulation, supply-chain vulnerabilities, insider risk, zero-trust architecture, AI-driven threat hunting, and resilience in operational environments.

“The machines running our infrastructure are getting smarter,” he said. “I wrote the book because I think it's time our security strategies did too.”

His professional experience helped him identify the problem, while his doctoral work at Cumberlands shaped how he researched and analyzed it.

“That discipline, reviewing the existing body of research carefully, being precise about claims, being honest about the limits of what I actually know, shows up directly in how I approached the book,” Shirke said. “I wasn't willing to write it purely from anecdote and years of war stories; I wanted the arguments grounded in something more rigorous.”

Coursework and conversations with Cumberlands faculty also encouraged him to think more broadly about policy and governance rather than approaching cybersecurity exclusively as an operational problem.

That mattered when considering AI systems operating in environments where the consequences of a bad decision can become physical.

What Skills Will Cybersecurity Professionals Need in the AI Era?

Despite those risks, Shirke sees considerable potential in AI.

“AI-driven anomaly detection and predictive resilience could meaningfully reduce the kind of catastrophic OT failures we've seen historically, if it's built and governed well,” he said.

His concern is what he calls a “pace mismatch.”

“Adoption is moving faster than governance, faster than workforce training, and faster than most organizations' ability to actually validate that these systems behave safely under adversarial conditions, not just normal ones.”

For cybersecurity professionals, preparing for that future doesn't necessarily mean becoming an AI expert overnight. Shirke argues that professionals will need to understand how AI systems fail while also developing a strong foundation in the operational environments where those systems are deployed.

“The people who will be most valuable over the next decade are the ones comfortable sitting at that intersection: understanding both the physical process being controlled and the model making decisions about it and asking hard questions about both before something breaks in a way that can't easily be undone.”

As the technology changes, those hard questions continue to drive Shirke's work.

Years ago, they led him from software engineering into cybersecurity. Later, they brought an experienced practitioner to Cumberlands in search of the research skills to question what years of professional experience had taught him.

Today, they are helping him examine what cybersecurity must become as the critical infrastructure people depend on grows increasingly intelligent and autonomous.

Take the Next Step in Information Technology

“University of the Cumberlands stood out because its cybersecurity doctoral program is genuinely built for people in my position: practitioners still working full-time, often in demanding roles, who want rigorous research training without putting a career on hold,” Shirke said.

Ready to deepen your expertise while continuing your career? Learn more about the Ph.D. in Information Technology at University of the Cumberlands and how advanced research can help you explore emerging challenges in cybersecurity, data science, information governance, and other areas of information technology.